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Quantum weak coin-flipping with bias of 0.192 
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A family of protocols for quantum weak coin-flipping which asymptotically achieve a bias of 0.192 
is described in this paper. The family contains protocols with n + 2 messages for all n > 1. The 
case n = 2 is equivalent to the protocol of Spekkens and Rudolph with bias l/y/2 — 1/2 ~ 0.207. 
The case n = 3 achieves a bias of 0.199, and n = 8 achieves a bias of 0.193. The analysis of the 
protocols uses Kitaev's description of coin-flipping as a semidefinite program. The paper constructs 
an analytical solution to the dual problem which provides an upper bound on the amount that a 
party can cheat. 

PACS numbers: 03.67.Lx 



I. INTRODUCTION 

Quantum coin-flipping is an attempt to solve the prob- 
lem of coin-flipping by telephone Ij] in a setting where 
the security is guaranteed purely by the laws of quantum 
mechanics. 

A typical description of the problem is as follows: Alice 
and Bob have been collaborating via email and are about 
to publish. Given their notorious lack of surnames, they 
would like to flip a coin to determine whose name appears 
first on the paper. Unfortunately, though good collab- 
orators, they don't completely trust each other, nor do 
they have a common acquaintance whom they both trust. 
Though they don't wish to meet in person, they do want 
to guarantee that the other person can't cheat and win 
the coin-toss with a probability greater than 1/2. Fortu- 
nately, they have at their disposal computers capable of 
sending and processing quantum email. 

More specifically, quantum coin-flipping is a two party 
protocol involving a sequence of quantum messages be- 
tween the parties, after which each party must output a 
classical bit. An output of zero will correspond to Alice 
winning whereas Bob will win on an output of one. The 
requirements of the protocol are as follows: (1) If both 
parties are honest then Alice's bit must be uniformly ran- 
dom, and it must always equal Bob's bit; (2) If Alice is 
honest, then independently of what Bob does, she will 
output one (i.e., Bob wins) with a probability no greater 
than Pg = i + €b', (3) If Bob is honest, then indepen- 
dently of Alice's actions, he will output zero with a prob- 
ability no greater than P£ = | + e^. We define the bias 
as f = max ( ea, c.b), which is the figure of merit for a 
coin-flipping protocol. In the ideal case we want e = 0. 

Note that no restriction is placed on the case when 
both players are dishonest. Nor are there any require- 
ments that the outcomes agree when one party is cheat- 
ing, which would be impossible to achieve. Furthermore, 
the protocol must start in an unentangled state, for if 
they could start in a known entangled state of their 
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choosing, the problem would be trivial. 

Strictly speaking the above problem is given the name 
weak coin-flipping because a cheating party may opt to 
lose. For example, no restriction is placed on Bob's abil- 
ity to force Alice to output zero. The case when neither 
party may bias the coin in either direction is called strong 
coin-flipping. 

Ambainis and Spekkens and Rudolph Q have con- 
structed strong coin-flipping protocols with a bias of 
e = j. It is also known that quantum strong coin- 
flipping protocols cannot achieve a bias smaller than 
e = 1/V2 - 1/2 ~ 0.207, as was proven by Kitaev 
(and summarized in Ref. 

There is less known about weak coin-flipping. The best 
known protocol prior to the present paper is by Spekkens 
and Rudolph q and achieves a bias of e = 1/V2-1/2- 
0.207 (previous protocols include Ref. 0)- The best 
known lower bound is by Ambainis Q and states that 
the number of rounds must grow at least as Vl (log log - ). 
In particular, this means that no protocol having a fixed 
number of rounds can achieve an arbitrarily small bias. 
Ambainis p| also proves the optimality of Spekkens and 
Rudolph's protocol within a family of 3-message proto- 
cols. 

It is likely that the bias achieved by Spekkens and 
Rudolph is optimal for any protocol involving three or 
less messages. However, as we shall show in this paper, 
a better bias can be achieved using more messages. 

In particular, we shall describe in Section [H] a family 
of protocols, indexed by an integer n > 1, with n + 2 
messages. The case of n = 2 with four messages will 
be equivalent to Spekkens and Rudolph's original proto- 
col. The protocols with more rounds will achieve an even 
better bias. 

The main result of this paper is the construction of 
quantum weak coin-flipping protocols which achieve a 
bias less than e = l/v2— 1/2. This excludes the possi- 
bility that Kitaev's bound for strong coin-flipping can be 
directly extended to weak coin-flipping, and establishes 
that it is not possible for the minimum bias of weak coin- 
flipping to equal that for strong coin-flipping in the con- 
text of quantum mechanics. We do not exclude the pos- 
sibility, though, that a three message protocol, outside 
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of the family analyzed by Spekkens and Rudolph, can 
achieve the optimal bias claimed by the present paper. 

The main technique used in this paper is Kitaev's 
description of coin-flipping as a semidefinite program. 
This description provides a dual problem whose solu- 
tions bound the amount that a party may cheat. Though 
this material has been previously published, it will be re- 
viewed in Section ITTT1 

The main contribution of the present paper is in Sec- 
tion [W] where we shall construct solutions to the prob- 
lem dual to the protocol of Section[nl These shall provide 
analytic upper bounds on the bias of the protocol. 

Our protocol for a given n depends on n parameters 
subject to one constraint, and we shall express the upper 
bound as a function of these parameters. Any choice of 
the parameters, consistent with the constraint, will give 
a valid protocol together with an upper bound on its 
bias. To find good protocols with small bias, we shall use 
a numerical minimization over the space of parameters. 
This will be done in Section Ivl 

We stress, however, that given a set of values for the 
parameters, these can be put into the analytic expression 
to obtain a valid upper bound on the bias. The existence 
of weak coin-flipping protocols with the quoted biases 
does not depend in any way on the accuracy or quality 
of the numerical minimization. 

Finally, the most interesting question is what happens 
in the limit n — > oo. We shall show that at least for some 
choices of the parameters, the bias does not converge to 
zero. In fact, it appears that most reasonable choices 
converge to the same point in this limit, which may in- 
dicate that this is the best bias that can be achieved by 
any quantum weak coin-flipping protocol. 

II. THE PROTOCOL 

We shall describe a family of weak coin-flipping proto- 
cols, indexed by an integer n > 2, which will involve n + 2 
messages. The protocols will also depend on a set of pa- 
rameters a\, . . . ,a n to be fixed later. These parameters 
define the two-qubit states 

\<k) = yfc\OQ) + VT=al\U). (1) 

The protocol begins with Alice preparing in her private 
Hilbert space the states \4>i) for odd i, while Bob prepares 
the states with even i in his Hilbert space. 

The first n messages of the protocol consist of sending 
halves of the states \cf>i). More explicitly, the i th message 
involves the owner of state \<pi) , who sends one of the two 
qubits comprising the state to the other party. After the 
first n messages, if both players were honest, the state of 
the system should be: 

n 

\1>)ab = ® (V*\°)a ® \°)b + VT^\1) A ® |l) fl ) , 
1=1 

(2) 



where the labels A, B denote the owner of the qubit in 
question. 

At this point each side will apply a two-outcome pro- 
jective measurement {Eq,Ei} to their n qubits. These 
operators will be described below but will have the prop- 
erties Ef = Ei and (Ei) A ®I B \^) AB = I a ® {E l ) B \i>) AB - 
These properties guarantee that when both parties are 
honest, their answers are perfectly correlated. We can 
therefore associate the outcome Eq with an outcome of 
zero for the coin flip, and the outcome E\ with coin out- 
come one. The requirement that the coin-flip be fair 
when both parties are honest: 

(^®E^) = i (3) 

will impose a constraint on the parameters {a,;}. 

At this point both parties should know the "honest" 
outcome of the coin-flip. Now they enter a stage of cheat 
detection in which the loser will examine the qubits of 
the winner. If no cheating is detected (which is guar- 
anteed when both players are honest) then the "honest" 
outcome becomes the final outcome. Otherwise, if the 
losing party detects cheating, that party may ignore the 
"honest" outcome and instead output his or her desired 
outcome (zero for Alice and one for Bob) . This is accept- 
able because the rules of weak coin-flipping don't require 
the parties to output the same bit when one party is 
dishonest. 

We now describe the cheat detection stage which will 
involve the last two messages: the winner of the coin 
toss according to the measurement {E Q ,Ei} sends over 
their entire Hilbert space for inspection. If Bob wins, he 
should send over his n qubits so that Alice obtains both 
halves of the state: 

y/2Ex2>Ex\ip) = y/2E l ®I\ip). (4) 

This is a pure state, and Alice can perform a two outcome 
projection onto this state and its complement. If she 
obtains the complement as outcome, she knows Bob must 
have cheated. More specifically, define 

E i ®E i \<<l))(>(l>\E i ®E i 

Alice measures using the projections {Fx, I — where 
outcome I—Fi implies Bob has cheated. In the case when 
the honest outcome is zero, Bob does the equivalent steps 
with {F ,I-F Q }. 

Officially, we shall define the protocol so that Alice 
always uses message n + 1 to either send her qubits (or 
nothing if she lost the honest coin toss), whereas Bob 
will use message n + 2 if he needs to send qubits. The 
ordering is irrelevant though, and it could also be defined 
so that Bob sends his verification qubits first when n is 
odd, thereby avoiding two messages in a row from Alice. 
Alternatively, they could be sent in the opposite order, 
combining the verification state with the last message in 
order to run the protocol with only n + 1 messages. 
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All that remains is to describe the projections Eq and 
Ei . Hcuristically, the measurement consists of the follow- 
ing process: Examine the qubits in order starting from 
the one belonging to \<f> n ) and ending with the one belong- 
ing to \4>i). The qubits are to be measured in the com- 
putational basis, until the first zero outcome is obtained, 
which implies that the sender of that qubit loses. If all 
qubits produce outcome one then Alice (being the first 
message sender) is the winner. Of course, the measure- 
ment is not performed in stages as described above but 
rather using the unique pair of projectors which produces 
the same distribution of probabilities. For example, for 
n = 2 we have 

Eq = |00)(00| + |10)<10| + |11)(11|, (6) 
Ei = |01)(01|, (7) 

where the leftmost qubit corresponds to the first qubit 
sent or received. The rest can be defined inductively by 
the formulas 

E { k+1) = J®^ fc) + |l-..l)(l-..l|, (8) 
E[ k+1) = I®E { k) - |1 - - - 1) <1 - - - 1| , (9) 

where the superscript indicates the number of qubits on 
which they are to act. For brevity, these superscripts 
shall be omitted, though. 

The case of n = 2 is equivalent to the protocol de- 
scribed by Spekkens and Rudolph in Ref. which 
achieves the tradeoff P%Pg = 1/2. The connection is 
made by setting ai — x and (1 — 02) = l/(2x). 

Summarizing, the protocol involves the following steps: 

1. Alice prepares \4>i) <g> |^ 3 ) ® |</> 5 ) ■ • • , 
Bob prepares |</> 2 ) <S> <S> \4>e) 

2. For i = 1 to n: 

If i is odd: Alice sends half of the state \<pi) to Bob, 
If i is even: Bob sends half of the state |</> 2 ;) to Alice. 

3. Alice performs the two-outcome measurement 
{Eo,Ei\ on her n qubits. Bob performs the 
same two-outcome measurement {Eq, Ei} on his n 
qubits. 

4. If Alice obtains Eq she outputs zero, and sends all 
her qubits to Bob. 

5. If Bob obtains Ei he outputs one, and sends all his 
qubits to Alice. 

6. If Alice obtained Ei she measures her qubits plus 
any qubits received from Bob with the projections 
{Fi,I — Fi}. If she obtains Fi she outputs one, 
otherwise (or if she receives the wrong number of 
qubits from Bob) she outputs zero. 

7. If Bob obtained Eq he measures his qubits plus 
any qubits received from Alice with the projections 
{Fq, I — Fq}. If he obtains Fq he outputs zero, oth- 
erwise (or if he receives the wrong number of qubits 
from Alice) he outputs one. 



A. Reformulation of the protocol 

For the analysis in the following section, it will be help- 
ful to delay all measurements to the last step. It will be 
also useful to never have to apply a unitary, or equiva- 
lently, send qubits conditioned on the outcome of a mea- 
surement. We will be able to formulate protocols with 
these properties if we are willing to allow one side to have 
increased cheating power. 

The idea is that the analysis of a coin-flipping protocol 
is divided into two separate steps: we need to analyze the 
case when Alice is honest and Bob is cheating, and then 
we need to analyze the case when Bob is honest and Alice 
is cheating. Let us focus on the first case when Alice is 
honest. 

We wish to describe a new coin-flipping protocol, where 
Bob's ability to cheat is exactly the same as in the origi- 
nal protocol, but where Alice may be able to cheat more 
than usual. We shall call the original protocol V and 
the new protocol V . The idea is that V will be sim- 
pler to describe than V and since at the moment we are 
only concerned with bounding Bob's ability to cheat, any 
bound derived for one protocol will apply to the other. 

The protocol V begins with the same initial state as 
V and the first n messages are identical. However, in V' 
after the first n messages no measurements occur. In- 
stead, Bob sends all of his n qubits to Alice. After this 
last message Alice performs the two-outcome projective 
measurement {Fx, I — Fx} as before and reports outcome 
Fx as Bob winning and I — Fx as Alice winning. Note 
that in V' , even when Bob is honest the outcome I — Fi 
can arise, that is, Alice does not differentiate between 
Bob losing honestly and Bob getting caught cheating. 

Technically, we should allow one last classical message 
from Alice to Bob, where Alice announces her outcome 
and then Bob repeats it as his own, but this won't be 
necessary as we are only concerned with the probabilities 
associated with Alice's output. 

It is not hard to see that any cheating strategy for Bob 
that can be used in V will produce the same probability 
of winning in V' ' , because the only thing that changed 
from Alice's perspective is that now she always expects 
to receive Bob's qubits. However, as protocol V was writ- 
ten, the only time that Bob could win was when he sent 
his qubits, so he loses nothing by always sending them. 
From a mathematical perspective, we are using the fact 
that FxEx = F x and (7 - Fx) Ex + E = I - F x . 

In conclusion, when analyzing the case of honest Alice, 
we can use protocol V . Of course, when analyzing the 
case of honest Bob and cheating Alice, V' is no longer 
useful, but we can define a new protocol V" in a similar 
way, where Alice always sends all her qubits to Bob. This 
protocol can be used to bound Alice's cheating power in 
V. 

For the rest of this paper, we shall employ protocols 
V' and V" where appropriate without further comment. 
However, all bounds derived will apply to the original 
protocol V as well. 
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III. COIN-FLIPPING AS AN SDP 

The problem of finding the optimal cheating strategy 
for a player can be cast as a semidefinite program (SDP). 
The dual problem then provides bounds on the maxi- 
mum bias that the cheating player may achieve. This 
approach was first described by Kitaev Q (and summa- 
rized in Ref. 0)- 

In the following section we will review Kitaev's con- 
struction, though using a somewhat different language 
than the original. What few results are needed from the 
theory of semidefinite programming will be derived along 
the way in order to keep this paper as self contained as 
possible. The discussion in this section will be completely 
general in the sense that it applies to any coin-flipping 
protocol. The results of this section will then be applied 
to the protocol at hand in Section Hvl 

A. The primary problem 

For simplicity, we shall focus on the case when Alice 
is honest and Bob is cheating. The opposite case when 
Bob is honest is nearly identical. 

We will work with protocols that can be cast in the fol- 
lowing form: The initial state is a fixed pure unentangled 
state shared by Alice and Bob. The protocol proceeds by 
applying unitaries on each individual side, and by send- 
ing qubits from Alice to Bob and vice-versa. In the last 
step, each party performs a two outcome projective mea- 
surement and outputs the result. 

In fact, the communication part of the protocol (i.e., 
everything but the initial state preparation and the final 
measurement) can be described as a sequence of the fol- 
lowing three elementary operations: one of Alice's qubits 
is sent to Bob, one of Bob's qubits is sent to Alice, or each 
side applies a unitary to their qubits. The unitary step 
is often not needed and can be completely removed if we 
allow each party to decompose their space into qubits in 
different ways on each round. 

Given a protocol, let m be the number of elementary 
steps, and let po be the density matrix describing Alice's 
qubits in the first step. Let pi be the density matrix 
describing Alice's qubits after the first i elementary op- 
erations, given some cheating strategy for Bob. These 
matrices must satisfy the following equations: 

• If step i involves sending qubit j from Alice to Bob: 

p^TrjPi-i. (10) 

• If step i involves Alice receiving a qubit from Bob 
and assigning it name j: 

Trjpi^pi^i. (11) 

• If step i involves Alice applying unitary Iff. 

Pi = Uip i - 1 Ur 1 . (12) 



It will be convenient to have a shorthand notation for 
these equations. They shall be written as Li(p.i) — 
Ri(pi-i), where Li and Ri are linear operators corre- 
sponding to the identity, partial trace, or conjugation by 
a unitary as needed to match the above equations. 

Clearly, no matter what Bob's strategy is, the above 
equations must be satisfied. Furthermore, because Al- 
ice's output probabilities are entirely determined by p m , 
a cheating strategy for Bob can be described in terms of 
the above sequence of density operators {pi}- In fact, it 
is not hard to see that by keeping the total state pure, 
Bob can make Alice have any sequence of density op- 
erators which are consistent with the above equations. 
Therefore, there is a one-to-one correspondence between 
cheating strategies of Bob (up to isomorphisms that pro- 
duce the same result on Alice's side) and density opera- 
tors poj ■ ■ ■ i Pm satisfying the above equations. 

After the communication rounds have been com- 
pleted, Alice makes a two-outcome projective measure- 
ment {Ea,Eb} to determine her output. Outcome Ea 
will correspond to Alice winning (i.e., final outcome zero) 
and Eb will correspond to to Bob winning (i.e., final out- 
come one) . Note that these operators are not the same as 
the {Eq,Ei} used in the last section, and in fact, when 
applied to our protocol Eb will correspond to Fx. 

Bob's goal is to choose a sequence of positive semidef- 
inite operators p\ , . . . , p rn satisfying the above protocol 
dependent equations, in order to maximize Tr(i?Bp m ). 
Note that po is always fixed by Alice's initial state, and 
the above equations fix the trace of the remaining ma- 
trices, therefore the maximization can indeed be done 
over all positive semidefinite matrices. We have there- 
fore proven the following lemma: 

Lemma 1. The maximum probability of winning that 
can be attained by Bob through cheating in a coin-flipping 
protocol described by the data m, po, {Li}, {Ri}, Eb is 
given by the solution of the maximization problem 

P* B = maxTr (E B p m ) , (13) 

involving the m positive semidefinite matrices px, . . . , p m 
subject to the constraints 

Li(pi) = Ri(pi-x) for all i = l,...,m. (14) 

B. The dual problem 

The beauty of semidefinite programing is that each 
SDP has a dual SDP. When the original problem involves 
a maximization, the dual problem involves a minimiza- 
tion. Furthermore, the optimal solution of the dual prob- 
lem will be greater than or equal to the optimal maximum 
of the original problem. In terms of coin-flipping each so- 
lution of the dual problem provides an upper bound on 
the amount that Bob can cheat. 

The variables of a dual SDP are Lagrange multipliers, 
one for each constraint in the original problem. There are 
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m equality constraints given by the m elementary opera- 
tions of the protocol, therefore there will be m Lagrange 
multipliers Z\, . . . , Z m . Each Zi will be a Hermitian ma- 
trix of the same dimension as Li(pi) and will be added 
in as a term of the form Tr[Zi(Li(pi) — Ri(pi-i))]. 
We will now lift the conditions Li(pi) = Ri(pi-i) on 



where in the third line we introduced Z m +i = Eb and 
Rm+i{p) = P- In the fourth line, we introduced the dual 
operators to Li and Ri in the sense that Tr[Li(p)Z] = 
Tr[pLf(Z)] and Tr{Ri(p)Z] = Tr[pRf(Z)] for all p and Z. 
These are easily constructed as follows: if Ri(p) — p then 
Rf(Z) = Z, i£Ri(p) = UipUr 1 then Rf(Z) = U^ZUi, 
and if Ri(p) = Tij p then Rf(Z) = Z (g) Ij, where the 
identity is inserted into the empty slot of qubit j. The 
expressions for Lf are defined similarly. 

From the above equation it should be clear that 

P^KTilZ^ipo)], (16) 

for any Hermitian matrices Z\,..., Z m subject to the m 
constraints 

Ri +1 (Z i+1 )-Lt(Zi)<0, (17) 

because under this constraint the second term is guar- 
anteed to be non-positive for any set of {pi}. We have 
therefore proven the following theorem: 

Theorem 2. Let Z\,...,Z m be any set of Hermitian 
matrices satisfying the m inequalities 

Lf(Zi) > Rf +1 (Z i+1 ) for i = l,...,m, (18) 

where m, Lf, Rf, Z m +x = Eb, and po are data associ- 
ated with a coin-flipping protocol. The maximum prob- 
ability that Bob can win such a coin-flip by cheating is 
bounded by 

P* B <T r [Z 1 R 1 {p )], (19) 

Our goal in the next section will be to guess sets of 
matrices Z\, . . . , Z m satisfying the inequalities Eq. (|18fl . 
and try to find a set that produces a good bound on Pjjj 
without worrying whether the bound is optimal. 



the operators {pi} allowing them to vary freely. The 
constraints will be dynamically imposed by the Lagrange 
multiplier terms. However, because the traces of {pi} are 
no longer fixed we shall impose the constraints pi < I so 
as to keep the expression Tr Esp m finite. We now have: 



(15) 



IV. FINDING SOLUTIONS TO THE DUAL 
PROBLEM 

Continuing the analysis of the case where Alice is hon- 
est and Bob is cheating, we need to find the problem 
dual to V. The protocol V' can be thought of as hav- 
ing m = n + 1 elementary operations if we relax the 
definition somewhat to allow the receiving of n qubits 
in the last message as one step. Each elementary step 
consists of either sending or receiving a message, and 
unitaries are never used. The final measurement is done 
with E B = Fx, E A = I - F\. 

It will be useful to define a specific ordering for the 
qubits in Alice's Hilbert space. The intuition is to picture 
qubits as carried by particles in a lattice. When played 
honestly, the initial state will be prepared on 2n particles, 
some of which will be controlled by Alice, and some by 
Bob. Sending a qubit from Alice to Bob simply means 
that the particle will now be controlled by Bob rather 
than Alice. Alice's full Hilbert space at each step will be 
the ordered tensor product of the Hilbert spaces of all 
particles she controls in that step. Note that this does 
not restrict the power of a cheating player, who could 
have as many extra qubits as he wants that can interact 
with any particle under his control. 

The ordering of the states will be as follows. The initial 
state is prepared so that \4>i) is carried by particles i and 
n + i. When n is even Alice starts off with all the odd 
particles in her possession whereas Bob has all the even 
particles. When n is odd Alice owns the odd particles 
between 1 and n inclusive, and the even particles between 
n + 1 and 2n inclusive. This is depicted in Fig. ^ 

The first steps involve Alice sending qubit n + 1, then 
receiving qubit 2, then sending qubit n + 3, and so on. At 




6 



103) 

102} pJ 

\<h) h — 

H , 

• O • • O • 

12 3 n+1 n+2 n+3 

FIG. 1: State ordering for n — 3. Black qubits are initially 
prepared by Alice. 



the end of the first n messages Alice will control the first 
n qubits. The last step involves Alice taking possession 
of the other n qubits. 

With these conventions, the primal problem reads: 



Pi = Tr n+i pi-i for odd % < n, 
T?i pi = pi-i for even i < n, 

plus one final equation 

Tr n+ i j ... i 2n Pn+1 — Pn- 



(20) 
(21) 



(22) 



With these conventions the dual problem involves find- 
ing m = n+1 Hermitian matrices Z\, . . . , Z n+1 . When n 
is odd, all the matrices have dimension 2™, whereas when 
n is even the matrix Z n+ \ has dimension 2™ and the rest 
have dimension 2"~ 1 . They must satisfy the following 
equations 

Z l > Z i+1 for odd i < n, (23) 

Zi® Ii > Z i+ i ® I n+ i+i for even i < n, (24) 

where the subscript on the qubit identity matrices indi- 
cate into which slot it should be inserted. If n is even, 
we also need Z n ®I n > Z n+1 . Finally, in addition to the 
previous n inequalities we need to satisfy 



Z n +1 ® In 



+l,...,2n 



> Z n 



+2 



Fi, 



(25) 



where the identity is inserted into the slot of the last n 
qubits. The goal is to choose the matrices in order to 
minimize (<p\Zi ® I n +i\(f) where \<p) — \(f>i) ® |0 3 ) ® • • • . 



A. Choosing Z\, 



Let (3 = (ip\Zi®I n+ i\(p). To minimize this quantity, it 
is to our advantage to choose the Zi matrices as small as 
possible in a sense to be discussed below. In particular, 
the optimal choice for Z\ is simply to satisfy the equality 
Z\ = Z 2 . We can remove Z\ from our equations and 
write 



(3 = (ip\Z 2 ® I n +i\<fi) = (V3| Tr ai Z 2 \cp 3 ), 



(26) 



where \ip 3 ) = \(j> 3 } (g) \<f> 5 ) (g) • 
weighted partial trace on the first qubit with weights a\ 



and Tr ai denotes a 



and 1 — a\. For example, when acting on a matrix that 
only involves the first qubit 

Tr ai M = ai<0|M|0) + (1 - a 1 )(l|M|l). (27) 

Note that in a slight abuse of notation, the subscript 1 in 
Tr ai indicates both which a, is used, and on which qubit 
the partial trace is performed. 

The next inequality, which reads Z 2 ® I 2 > Z 3 ® I n +3 , 
is harder to satisfy, and in general equality cannot be 
achieved. However, we don't need to pay much attention 
to what happens in the subspace orthogonal to \<P3), and 
we can in a sense sacrifice this subspace in order to obtain 
small entries in the subspace that we are interested in. 

More specifically, let T 3 be the partial trace 



T 3 (M)=Tr ]ip3) [(I 1 , 2 ®\<p 3 )(<p 3 \)M\, 



(28) 



where the trace is taken only over qubits that are involved 
in |v?3), that is, qubits 3, n + 3, 5, n + 5, and so on. The 
equation Z 2 ® I 2 > Z 3 ® I n + 3 requires T 3 (Z 2 ® I 2 ) > 
T 3 (Z 3 <g) I n + 3 ), which is an equation involving only the 
first two qubits. We will begin by finding the optimal 
choice in this subspace. 

Let us assume that 13(^3 ® /n+3) is a diagonal matrix 
with entries xoo, 2:01, 2:10, £11 ■ We want to choose T 3 {Z 2 ® 
I 2 ) to be as small as possible while still satisfying the 
inequality. However, because of the linearity of T 3 , the 
matrix T 3 (Z 2 ® I 2 ) will have the form M ® I 2 , for some 
one-qubit operator M. The equation M ® I 2 > T 3 (Z 3 ® 
In+ 3 ) becomes 
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(29) 

where Mo, Mi are the diagonal entries of M in the com- 
putational basis, and M c is the complex off-diagonal en- 
try. 

Since we are trying to minimize {(p 3 \Tv ai Z 2 \ip 3 ) = 
Tr ai M, the best choice is to take M = max(xoo, £01), 
Mi = max(xio,xii) and M c = which clearly satisfies 
the inequality. Notice that the maximum is taken over 
pairs of eigenvalues whose computational basis eigenvec- 
tors differ only in the second qubit. Symbolically, we 
shall write this as 



M 



max [T 3 (Z 3 



In 



(30) 



where the operator max is defined only for diagonal ma- 
trices. The subscript 2 specifies that the maximum is to 
be taken over subspaces that differ in the second qubit. 

The above discussion is only valid when T 3 (Z 3 ® /n+3) 
is diagonal, but we can impose this constraint on Z 3 (and 
the equivalent constraint on future Z{), which is accept- 
able because we are only looking for a solution of the 
inequalities, even if it is not the optimal solution. 
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Now if we could choose Z 2 to satisfy the full inequality, 
and still satisfy T 3 (Z 2 ) = M for the matrix chosen above 
we would have 



/? = Tr ai max[T 3 (Z 3 



(31) 



The following lemma shows that it is possible to choose 
Z 2 so that we can get arbitrarily close to the above result. 
Because we will use (3 to upper bound P Bl it doesn't 
matter if it is an infimum, and therefore we can use the 
lemma to eliminate Z 2 in favor of the above expression. 

Lemma 3. Let T 3 be as above, and let H be a Hermitian 
matrix with finite eigenvalues. Given a Hermitian matrix 
M such that M®I 2 > T 3 (H) and an e > 0, there exists a 
matrix M' such that M'®I 2 > H and T 3 (M') =M + eI. 

Proof. Let P = I\, 2 ® |^ 3 )(</? 3 | be the projector which 
was used in defining T 3 . This divides the Hilbert space 
on which H acts into the direct sum of two parts, one 
invariant under P and one perpendicular to it. We write 
this as W = ft" 0H 1 . 

Let A be the largest eigenvalue of (I — P)H(I — P). 
Define the block diagonal matrix B as follows: the block 
acting on the space has the form M <g> I 2 + el, and 
the block acting on Ti 1 - has the form (A + y)I for some 
constant y > 0. 

Let 7 be the maximum over normalized states |^),|$) 
of \{$\PH(I-P)\i&)\. Then for any normalized state |*) 
we have 

> e<tf|P|tf) + y(*\(I- P)|tf) (32) 
-2 7A /(*|P|*)(*|(/-P)|*). 

As long as y > the expression is greater than zero, 
which implies B > H . It should be clear that B has the 
form M' ®1 2 and that the M' defined in this way satisfies 
T 3 (M') = M + el. □ 

The above lemma is used with H = Z 3 (g> I n +3, and 
letting Z 2 = M' . At this point the pattern begins to 
repeat itself. We can choose Z 3 = Z4 and get 

(3 = Tr ai max [T 3 (Z 4 ® J n+3 )] = Tr ai max [Tr a3 T 5 {Z 4 )] , 

(33) 

where T 5 is the partial trace using the state |<^ 5 ) = |0 5 ) (g) 
® ■ ■ ■ ■ 

Using the lemma again we eliminate Z4 in favor of Z5: 



(3 = Tr ai max Tr a3 max [T 5 (Z 5 <g> I n+5 ) 

2 1 4 



(34) 



where the expression is only valid if T 5 (Z 5 (g) I n +b) is 
diagonal in the computational basis (which will force 
T 3 (Z 3 ® In+3) to be diagonal as well). 

One may worry that repeated uses of the lemma will 
make Z 3 have arbitrarily large entries which means that 
the lemma can no longer be used to eliminate Z 2 . But 
the problems can be eliminated by taking the limits in 
the proper order, or more appropriately, by making sure 



that the coefficient y associated with Z 2 is much larger 
than the one associated with Z4 which in turn needs to 
be much larger than the one associated with Z 6 and so 
on. 

The process is repeated until in the last step, when n 
is odd, the innermost expression is of the form T n (Z n ® 
hn) = T n (Z n+1 <g> J 2 „) = Tr a „ Z n+1 , yielding 

/3 - Tr ai max [Tr 03 max [Tr a5 • • • Tr a „ [Z n+ i]]] . (35) 

When n is even, we had the special inequality Z n ® I n > 
Z n+ i which is satisfied by choosing Z n = max[Z„ + i], so 

n 

that we get the same alternating expression, with the 
innermost operation a max: 



/3 = Tr ai max Tr a3 max Tr a5 • • • max \Z n +i 



(36) 



Both of these formulas are valid only if Z n+ i is diago- 
nal in the computational basis, which will make all the 
matrices of the form Tj(Zj) for odd i diagonal as well. 

We are now left with the task of minimizing (3 as a 
function of Z n+ \ with the constraint that Z n+ \ must be 
real and diagonal in the computational basis and must 
satisfy the inequality Z n+ i <& I > F\. 

In fact, when Z n+ \ is diagonal the inequality can be 
simplified further. In the qubit ordering we have chosen, 
the final state of the protocol right before measurement 

should be \il>) = |0l)l,„+l ® l</>2} 2 ,„+2 ® ■ ■ ■ ® |0 n >„ i2 „ 
where we have explicitly listed the location of each qubit. 
Therefore F\ = 2E\ ® E\\tj)) {tp\Ei ® E\ has support only 
on the 2™ dimensional subspace spanned by states where 
qubits i and i + n are equal for all i. The constraint 
Z n+ i ® I > Fi need only be checked in this subspace 
where it takes the form 



Zn+l > \Sb)(Zb\ 



(37) 



where 



10 = (V^T|o) + VT — ^T|i))®(v^|0) + Vi — ^|i)) 
(^|o) + VT — ^|l», (38) 

and \£b) = V2Ei\£), which is correctly normalized by 
the factor y/2 if the coin is fair when both players are 
honest. 

B. Example n = 3 

At this point an example would probably be helpful. 
We shall look at the case n = 3: 

\£ B ) = y/2 ( Vol a 2 a 3 |000) + ^ ai {\ - a 2 )a 3 \Q\Q) 
+ v /a 1 (l-a 2 )(l-a 3 )|011) 
- ai)a 2 a 3 |100) 

- a 2 )a 3 |110)), (39) 
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and the matrix Z<± can be chosen as 
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(40) 



where the top row corresponds to |000) , the second one to 
1 001) and so on. The entries along the diagonal of Z4 out- 
side of the support of |£b)(£.b| have already been set to 
zero, which should be expected for all optimal solutions. 
Otherwise, any set of {xi} that satisfies Z4 > \£b)((;b\ 
is a valid solution of the dual problem. The correspond- 
ing bound can be calculated from these variables using 
Eqs. H35|l or equivalently by evaluating the tree depicted 
in Fig. 

The tree is evaluated as follows: each node has a value 
that is either the maximum or the weighted sum of the 
nodes below it. The weighted sum is just times the 
value of the left descendant plus 1 — Oj times the value of 
the right descendant. The value of the root node corre- 
sponds to (3 and is an upper bound on . We shall call 
trees of this form Sum-Max trees. 

Sum-Max trees appear naturally when analyzing clas- 
sical protocols for coin-flipping. The basic idea is that 
these protocols can be described as a sequence of public 
random bits, with the first one announced by Alice, then 
the second one by Bob and so on. At the end both parties 
look at the sequence of bits and determine the outcome 
of the coin-flip. The whole protocol can be described as 
a binary tree, with Alice's bits choosing the path at the 
odd depth nodes and Bob's bits controlling the rest. 

A player attempting to cheat in such a protocol will 
not output random bits but will instead choose the path 
that maximizes his chances of winning at each node. If 
we put ones and zeros in the leaf nodes corresponding to 
a win or loss, the maximum probability with which the 
cheater can win is given by evaluating the corresponding 
Sum-Max tree. 

If we ignore the cheat detection stage in the protocol, 
then it can be described completely classically. Its Sum- 
Max tree would be the same as Fig. [21 except that all 
the variables would be replaced by the number one. This 
can easily be seen from our formalism, because the only 
effect of removing the last round is to force Z n+ i to equal 
Ei which is diagonal with ones in place of the variables 

It is well known that in the classical case, one party 
can always fully bias the coin in their favor. However, 
in the quantum case with cheat detection, because the 
leaves of Sum-Max tree are less restricted, there is the 
possibility of obtaining a stronger bound on the amount 
of cheating. 

The analysis so far has been of the case when Alice 
is honest and Bob is cheating. The case of Bob honest 



and Alice cheating is almost identical, though. The first 
major difference, is that this case has to be analyzed 
from Bob's perspective, so that the odd messages consist 
of receiving a qubit and the even ones involve sending a 
qubit. This has the effect of switching sums with maxes 
and vice versa. The other difference is the final state 
that Bob will use to verify that Alice is not cheating. 
For n = 3 it has the form 

\U) = V2 ( y/a ia2 (l - O3)|001) (41) 
+ ^(1- 01)02(1 -a 3 )|101) 
+ V(l-ai)(l-a 2 )(l-a 3 )|lll». 

The maximum probability with which Alice can cheat, 
P\, is bounded above by a, calculated from the Max-Sum 
tree in Fig. [31 where the leaves are the diagonal elements 
of Z± and must satisfy Z4 > \£a)(£a\- 

C. Finding the optimal Z n+ i 

Returning to the case of honest Alice, we need to finish 
the general case by choosing a matrix Z n+ i in order to 
obtain an expression for (3 in terms of the parameters 
Oi, . . . , a n . Recall that we have restricted our analysis 
to matrices Z n+ \ that are diagonal in the computational 
basis. We shall now search for the minimum value of [3 
consistent with this choice. 

Let x\,. .. ,X2™ be the diagonal entries of Z n+ \. We 
will, as in the example above, set the variables to zero 
when their corresponding basis vector is orthogonal to 
|£b), which will leave around half of the variables. We 
also wish to work in the subspace where the two val- 
ues entering a max node in the Sum-Max tree are equal. 
For example, this is the space consistent with 03X0 = 
03^2 + (1 — 03)2^3 and X4 — xq in the example above. 
The only potential problem exists at the lowest level of 
max nodes, where a zero can be entering the node. For 
the following we will assume that n is odd which elimi- 
nates this problem. The even case will be derived from 
the odd case below. 

Working in this subspace we can replace all the maxi- 
mums with weighted sums with any weight of our choice. 
In this situation, (3 can be calculated as a weighted trace 
of Z n+ i. That is, there exist diagonal matrices W such 
that (3 = Tr(Z n+ iW) for any Z n+ i in this subspace. For 
example, a valid choice for W is the diagonal part of 
which replaces the max nodes at each level i by 
the weighted sum using o^. That is 

Tr[Z n+ i diag(|f)(£|)] = Tr Ql Tr Q2 Tr Q3 • • • Tr Qn Z n+1 . 

(42) 

This will turn out to be the wrong choice for W but it 
gets us closer to the following lemma: 

Lemma 4. Let |\&) be a state, not necessarily normal- 
ized, and let D be the diagonal part 0/ |\&)(\&|. Let 
E = E 2 be a diagonal projector. 
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FIG. 2: Cheating Bob's Sum-Max Tree 
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FIG. 3: Cheating Alice's Sum-Max Tree 



The minimum of Tr(ZD) over diagonal real matrices 
Z, subject to the constraint Z > 2E\ty) {^\E, is given by 
2|(*|i?|*)| 2 and is attained by 



2WEWE. 



(43) 



Proof. Because Z is diagonal we can write Tr(ZD) as 
Clearly if Z > 2E\V){$\E then Tr(ZD) = 
(^\Z\^f) > 2|(*|£;|*)| 2 . It is also attainable using 
Z = 2( i &\E\ i &)E which satisfies the inequality con- 
straint because by Cauchy-Schwarz ($\E\"&) {<f>\E\$) < 
(*|J5|*)($|.E7|$) for any |$>. □ 

Because \£,b}(£,b\ = 2-Ei|£)(£|£i, we are almost in the 
situation covered by the above lemma. Unfortunately, we 
are only maximizing over the space consistent with the 
entries to every max node being equal (while keeping the 
zero entries in Z n+ \ equal to zero), so in general Z n+ \ 
proportional to E± is not a valid solution. However, by 
rescaling the variables, we can get to the situation where 
this subspace contains E\ , and therefore the above lemma 
is useful. 

More specifically, let S be a diagonal positive ma- 
trix. Define Z' n+1 = y/SZ n+1 y/S. We now can min- 
imize (3 = Tr (Z'^VS^WVtF 1 ) subject to the con- 
straint Z' n+1 > VS\{;b) (£b\VS . We would like to choose 



S so that Z' rl 

Z, 



Ei is a valid solution, that is, when 
S^ 1 = S~ 1 E\ is put into the Sum- 



i = VS^-Ex 

Max tree, the pair of values entering each max node are 
equal. We also need to define W as the diagonal part 
of S\^} (!;\S. For this to be valid, we must show that 
we can compute (3 as a function of Z n+ \ by the expres- 
sion Ti:(Z n+ iW) for every Z n+ \ consistent with the orig- 
inal requirements. If these two conditions are satisfied, 
though, then the lemma tells us that 



(3 = 2 mSExW 



(44) 



where we used the fact that both S and E\ are diagonal 
in the computational basis. 

We begin by analyzing as an example the case of n = 
3 depicted in Fig. Define = (i\Ei\i) which takes 
the values zero or one. Similarly, let Si = (i\S\i). We 
construct S so that 



(45) 
(46) 
(47) 
(48) 



The factors gq, ool, and <tor should be thought of as 
being associated with the left max node. The first one 
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is a normalization factor, and the other two will be used 
to balance the values of the left and right descendants. 
Similarly, the other three variables are associated with 
the right max node. 

To satisfy the first constraint, we set Z n+ \ = 
or cquivalently, x, = s~ 1 ei. Note that the e, factor will 
force the appropriate x\ variables to be zero. We focus 
on the left max node. The value entering through the 
left descendant is 

a 3 , + (l-a 3 ), 1 = a3e0 + (1 - a3)ei ) (49) 

whereas entering on the right side is 



a 3 x 2 + (1 - a 3 )x 3 



a 3 e 2 + (1 - a 3 )e 3 



(50) 



For the two values to be equal, we can choose <tol = 
a 3 e + (1 - a 3 )ei and a 0R = a 3 e 2 + (1 - a 3 )e 3 . Similarly, 
the constraint at the other max node can me met by 
choosing o\l = a 3 e 4 + (1 - a 3 )e 5 and am = a 3 e 6 + (1 — 
a 3 )e 7 . 

Now we need to check the constraint on W — 
&\&g(S\£){(\S). Now Tr(Z n+ iW) can be described as the 



Max-Sum tree in Fig. with the max nodes replaced 
by sums. Focusing again on the left max node, it adds 
a 20"o f7 oL 01 i ts l ei t descendant plus (1 — a 2 )<jQ<iQ R °f the 
right descendant. We need these quantities to sum to one, 
and therefore do = [a-2&oL + 0- ~~ (X 'z)' 7 qrY~ 1 ^ 2 • Similarly, 
we choose a\ — [a 2 (r\ L + (1 — o^Oof^] -1 / 2 to normalize 
the sum replacing the right max node. 

Now we can finally evaluate (3 = 2 \{£\SEi\£)\ 2 . This 
can also be represented by a tree similar to the one in 
Fig. [3 with the max nodes replaced by different sums as 
follows: the left max evaluates to cl 2 (Jo<jql times the input 
from the left plus (1 — a 2 )aoaon times the right input. 
But the left and right inputs are respectively equal to 
a 3 e + (1 - a 3 )ei = a 0L and a 3 e 2 + (1 - a 3 )e 3 = a 0R , so 
the node evaluates to 



a20WoL + (l~ a 2) cr OOoR = 



a ^0L + C 1 - a 2)Cofl> 



(51) 



which can be though of as the weighted root mean square 
of the values of the two descendant nodes. The same 
thing happens at the right max node. The complete ex- 
pression then becomes 



J 



(3 = 2 jaiy 1 a 2 [a 3 e + (1 - a 3 )ei] 2 + (1 - a 2 ) [a 3 e 2 + (1 - a 3 )e 3 ] 2 

+ (1 - a\)y a 2 {a 3 a + (1 - a 3 )e 5 ] 2 + (1 - a 2 ) [a 3 e 6 + (1 - a 3 )e7\ 



2< ai\ a 2 aj + (1 - a 2 ) + (1 - ai)a 3 



(52) 



The above has the shorthand notation given by 

/3 = 2(Tr ai RMS a2 Tr a3 £; 1 ) 2 (53) 

where we define RMS a; only on diagonal matrices, as 
a weighted root mean square of eigenvalues whose basis 
vectors differ only on qubit i. This is in the same spirit 
as Tr ai which does a regular weighted average. 

For completeness, we also give the expression for a 
when n = 3, which can be obtained from the formulas 
derived below: 

a = 2(l-a 3 )(a ia 2 + (l- ai )). (54) 

The general case is almost identical. Consider the orig- 
inal Sum-Max tree for a given odd n. Let Ai be the set of 
max nodes of the original tree, that is, the set of binary 
nodes with odd depth (where we define the depth of the 
root node as zero). For each \i € M. we introduce three 
variables: a^, ct^l and ct^r, which are to be associated 
with the corresponding max node. We define the com- 
ponents of S in terms of these variables as follows: the 



value of Sj, which is to be associated with leaf j, is given 
as the product of u^u^l for every node /j, of which j is 
a left descendant, times the product of a^a^n for every 
node /i of which j is a right descendant. 

The conditions on W are always satisfied by choos- 
ing = [a M cr 2 L + (1 - a^)^] -1 / 2 for every fi E M, 
where in a slight abuse of notation a M is the parame- 
ter associated with /i (i.e., a M = a^^+i, where d{fj) is 
the depth of node /i). The next condition that needs to 
be checked is that, when the diagonal entries of S~ 1 E\ 
are placed on the leaves of the original tree, the left and 
right descendants of each max node must be equal. We 
shall choose the values of ct^l and a^n in order to guar- 
antee this, in a process that begins at the lower nodes 
and proceeds upwards. At the lowest level they are cho- 
sen so that ct m l = a«e M LL + (1 - a^e^LR, where e pLL 
and e^LR are respectively the left and right leaf values 
under the left child of node fi. Similarly, we also set 
cr^R = a n e M RL+(l-a n )e (U fl_ R , in terms of the leaves under 
the right leg of node jji. Having made such a choice, the 
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value of node fi in the Sum-Max tree equals o~~ x (up to 
multiplication by a factors from higher nodes). For every 
other fi e M that is not associated with the lowest level 
max nodes, we set ct mL = a d{fJ ; )+2 a^ + (1 - a d ^ }+2 )cr^} , 
where p! and fi" are respectively the left and right max 
nodes located under the left leg of max node fi. With an 
equivalent choice for o^r, the value entering either leg 
of max node fi will be a~ x (up to a factors from higher 
nodes) and the second condition will be satisfied. 

Finally we need to evaluate {£\SE\\£). Once again 
this is to be done as a tree, with binary nodes corre- 
sponding to sums. The factors of cr M , ct m l, and o^r can 
be moved up the tree so that the node fi becomes the 
weighted sum of a^a^a^L times the left descendant plus 
(1 — a^a^a^R times the right descendant. All that re- 
mains on the leaves are the zero or one values of E\ . The 
tree can be evaluated recursively from the bottom up, in 
which case it is easy to see that the value of a non-root 
binary node outside of M. (i.e., one of the original sum 
nodes), is equal to either u^l or o^r, where fi denotes 
its parent node, depending on whether it is a left or right 
descendant respectively. On the other hand, for fi G A4, 
node fi has value a^a^a 2 ^ + (1 - a^a^a 2 ^ = a~ l . The 
root node (which originally was a sum node) has value 
a\<7~} + (1 — ai)a~,} , where fi' and fi" are respectively its 
left and right descendants. The square of this quantity 
multiplied by two is the the value of our upper bound, 
which can be expanded using the definitions for the a 
variables to obtain: 

= 2 (Tr Ql RMS Q2 Tr„ 3 RMS Q4 • • • Tr a „ E x ) 2 , (55) 

valid only for n odd, to which the above discussion 
was restricted. Though the case of even n can also be 
found similarly, it can be obtained from the above for- 
mula by the following observation: the protocol with n 
steps and constants a\, . . . ,a n is equivalent to the pro- 
tocol with n + 1 steps and constants a' 1; . . . , a' n+1 with 
a' n+1 = and a' t = ai for all 1 < i < n. Further- 
more, if Ei is the projector associated with the n step 
protocol, and E[ is the projectors associated with the 
n + 1 step protocol, the two matrices are related by 
Tr an+1=0 ^ = RMS an+1=0 E[ = E^ Therefore, for even 
n we have 

(3 = 2 (Tr ai RMS a2 Tr a3 RMS a4 • • • RMS a „ E x f . (56) 

All that remains is to analyze the case where Bob is 
honest and Alice is cheating. Though this could be ana- 
lyzed using the methods presented in this section, we can 
exploit further symmetries of the protocols to obtain the 
result. In particular, the protocol with n steps and con- 
stants ax , . . . , a n is equivalent to the protocol with n + 1 
steps and constants a' l7 . . . , a' n+1 with a[ = 1, a' i+1 = 
for all 1 < i < n, and Alice's and Bob's roles switched. 
Furthermore, if Eq is a projector associated with the n 
message protocol, and E[ the projector associated with 
the n + 1 step protocol, the two matrices are related by 
Tr Ql= i E[ = Eq. We also need to use the fact that Tr ai= i 



commutes through all the RMS operators because it is a 
projector onto a subspace rather than a trace. Combin- 
ing all the results, we have proven the following theorem: 

Theorem 5. In the protocol described in Section ^ 
Alice 's and Bob 's ability to win by cheating are upper 
bounded by 

P* A < a = 2(RMS ai Tr Q2 RMS a3 Tr a4 ---Tr a „£;o) 2 , 
P* B < /? = 2(Tr Ql RMS a2 Tr a3 RMS Q4 ---RMS a „£; 1 ) 2 , 

when n is even, and by 

P* A < a = 2 (RMS Q1 Tr Q2 RMS a3 Tr 04 • • • RMS a „ E f 
P* B < /? = 2(Tr ai RMS a2 Tr a3 RMS Q4 ---Tr a „£ 1 ) 2 , 

when n is odd. 

Note that all the above formulas are valid only when 
the parameters a\, . . . , a n are chosen so that the honest 
probability of winning is 1/2. This is the source of the 
factor of 2 appearing in front of the expressions, which 
could be replaced by one over the honest probability of 
winning for more general scenarios. 

In fact, the above formulas are even more general, as 
they apply to any choice of {Eq, Ei} as long as they are 
diagonal projectors. In such a case, the symmetries that 
were used above are no longer valid, but direct compu- 
tations should lead to the same formulas. 



V. CHOOSING ai,...,a n 

Recall that any choice of parameters oi, . . . , a n subject 
to the constraint (ip\Ei ® E^-tp) = i describes a valid 
quantum weak coin-flipping protocol. Furthermore, we 
have an analytic upper bound on the bias given by 

e < max(a,/3) - -, (57) 

expressed as a function of these parameters. Now we 
need to chose values for the parameters, which ideally 
should be selected to produce a bias as small as possible. 

Because the expressions for a and (3 are complicated, 
we shall employ numerical minimization to find optimal 
values for the parameters for certain small values of n. 
The values obtained will prove the existence of protocols 
with the quoted biases. 

Fortunately, the quality of the minimization does not 
need to be verified. For example, it would be perfectly 
acceptable if rather than finding the true minimum, we 
only found a local minimum, or even if the outputted 
parameters did not constitute a minimum at all. All that 
is needed is for the parameters to satisfy the constraint, 
and produce the quoted bias when substituted into the 
expressions for a and [3. 

Note there is an issue with the constraint because it 
can only be satisfied to the accuracy with which the pa- 
rameters are specified. That is, when the parameters 
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are described to finite accuracy, the coin will not be ex- 
actly fair when both players are honest. Of course, this 
is to be expected for any practical implementation of the 
protocol. However, we also claim that from a theoret- 
ical perspective, there are parameters close to the ones 
quoted that satisfy the constraint exactly, and produce 
protocols with a bias equal to the quoted numbers to the 
given accuracy. 

In addition to the constraint (ip\Ei ® Ei\if>) — h, 
the minimizations were carried out with the constraint 
a = (3. For n — 3, we find a — (3 ~ 0.69905 at 
ax = 0.74094, a 2 = 0.479696 and a 3 = 0.186312. Though 
strictly speaking we should write that there exists a pro- 
tocol with n = 3 and e < 0.1991, for simplicity we will 
write e = 0.199 which is understood to be correct only 
up to the given accuracy. 

Though so far we have only derived an upper bound 
on the bias, it is fair to claim that there exist protocols 
with a bias equal to the upper bound because protocols 
can always be weakened. For example, in the first round 
with some probability Alice decides to let Bob determine 
the outcome of the coin, otherwise, with some probability 
Bob decides to let Alice determine the coin outcome and, 
if none of these events take place, then the protocol is 
started normally. 

Continuing with the analysis of small n, wc find: for 
n = 4 we get e ~ 0.1957, for n — 6 we get e ~ 0.1937, 
for n = 8 we get e ~ 0.1931, and for n — 10 we get 
e ~ 0.1927. For completeness, we list the values used for 
n = 8: ax = 0.680706, a 2 = 0.43281, a 3 = 0.323787, a 4 = 
0.264123, a 5 = 0.224377, a 6 = 0.197997, a 7 = 0.177191 
and a 8 = 0.0834815. 

To analyze larger values of n one needs to change the 
exponential formulas for a and (3 into expressions that 
can be computed in a time linear in n. This can be done 
because of the special structure of our choice of {Eq, Ei}. 
Because the construction is not central to the claims of 
this paper, we shall only give a brief example below: 

The expression Tr ai RMS a2 • • • Tr 0n E\ can be com- 
puted using a tree, with binary nodes alternating be- 
tween weighted sums and weighted root mean square. 
The leaves at the lowest level take only the two values 
zero and one, which should be though of as a high value 
and a low value. Entering into the lowest sum nodes are 
only two possibilities: both entries are the high value, or 
the left descendant is high and the right one low. There- 
fore, if we assign values to the sum nodes they will only 
take on two values, a high value (equal to the previous 
high value) and a low value (equal to the weighted sum 
a„High+ (1 — a n )Low). Entering into the next level RMS 
node there are also only two possibilities: two low values, 
or a high (from the right) and a low (from the left). This 
structure repeats all the way up to the root node, which 
is computed as the weighted sum of the high and low of 
the previous node. 

In summary, the value of Tr Ql RMS Q2 • • ■ Tr Qn E\ can 
be computed in linear time as follows: Start with 
(H n ,L n ) = (1,0) and update using the two rules (1) 
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FIG. 4: Plot of the bounds on cheating as a function of n, 
for parameters au = 1/k. The solid line corresponds to /3 and 
dotted line to a. These bounds are only valid for even n. 



if n — i is even then = Hi and = e^i/j + 

(1 — ftj)Lj, (2) if n — i is odd then = Li and 

Hi-i = yJaiLf + (1 — ai)Hf. The value of the root node 
is L — aiHi + (1 — a\)L\. The value of (3 is then two 
times the value of the root node squared. The value of 
the constraint can also be computed in a similar way by 
replacing the weighted root mean square average with a 
weighted linear average. 

Using these linear time formulas, it is possible to com- 
pute a and (3 for large values of n given a specific func- 
tional form for ak as a function of k < n. A theoreti- 
cally pleasant, though non-optimal choice, is a^ = 1/k 
for n even. Recall that {Eq, E{\ can be described by the 
process whereby the qubits are examined starting from 
qubit n to qubit 1 , and the first zero that is found deter- 
mines the winner. With ak — 1/fc, the probability that 
qubit k needs to be examined is k/n, and therefore each 
qubit determines the outcome with a probability of 1/n. 
The problem with this choice is that Bob's probability of 
winning given that qubit k needs to be examined keeps 
oscillating between 1/2 and numbers greater than 1/2. 
That is why for = 1/k, Bob has the ability to cheat 
a lot, whereas Alice is more restricted. With some work, 
the problem could be fixed by adjusting the values of ak 
for k ~ 1 and k ~ n. 

The values of a and f3 as a function of even n for ak = 
1/k have been plotted in Fig. ^ The upper solid line 
corresponds to (3 and the lower dotted line to a. For odd 
n we would have to use ak = l/(fc + 1) to satisfy the 
constraint, and this would switch the values of a and (3. 

For large n, the graphs converge towards 0.6922, or 
a bias of e = 0.1922. The same behavior occurs with 
many other reasonable choices for ak as a function of k. 
We believe that all choices will converge in the limit of 
n — * oo to a bias of 0.1922 (or higher for bad choices), 
but we shall not prove this in the present paper. 
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VI. SUMMARY 

We have shown the existence of quantum weak coin- 
flipping protocols with biases as low as 0.193 and converg- 
ing to a number near 0.192 as n — > oo. Unfortunately, 
this appears to be the smallest bias that can be achieved 
by the protocol described in this paper for any number 
of rounds. 

Many possibilities remain open. The first is that quan- 
tum weak coin-flipping with arbitrarily small bias is im- 
possible, and that the optimal bias is either 0.192 or some 
number below it. This would be unfortunate, but in the 
opinion of the author not all that improbable. 

Another possibility is that there exists a different fam- 
ily of protocols that produces arbitrarily small bias. In 
fact, a third possibility is that the protocol presented 
in this paper has an arbitrarily small bias. This could 
happen either because some better choice of parameters 



{ak} does produce arbitrarily small bias, or because the 
upper bounds a and (3 are not tight and converge to a 
different value than the true bias. The last possibility 
could be eliminated by constructing cheating strategies 
that achieve biases equal to the upper bound. 

Further research will be needed to distinguish these 
possibilities, and to finally settle the question of whether 
quantum weak coin-flipping with arbitrarily small bias is 
possible. 
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